I didn't see him mention his method, was going to suggest using certificate transparency logs. I believe there's some sites that allow for searching through the

I didn't see him mention his method, was going to suggest using certificate transparency logs. I believe there's some sites that allow for searching through them. Quite good for finding all subdomains (that have a TLS cert, which should be pretty much all of them nowadays).